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Abstract. In this paper we turn the spotlight on a class of lexicographic 
ranking functions introduced by Bradley, Manna and Sipma in a seminal 
CAV 2005 paper, and establish for the first time the complexity of some 
problems involving the inference of such functions for linear-constraint 
loops (without precondition). We show that finding such a function, if one 
exists, can be done in polynomial time in a way which is sound and com¬ 
plete when the variables range over the rationals (or reals). We show that 
when variables range over the integers, the problem is harder—deciding 
the existence of a ranking function is coNP-complete. Next, we study 
the problem of minimizing the number of components in the ranking 
function (a.k.a. the dimension). This number is interesting in contexts 
like computing iteration bounds and loop parallelization. Surprisingly, 
and unlike the situation for some other classes of lexicographic ranking 
functions, we find that even deciding whether a two-component ranking 
function exists is harder than the unrestricted problem: NP-complete 
over the rationals and X'f-complete over the integers. 


1 Introduction 

Proving that a program will not go into an infinite loop is one of the most fun¬ 
damental tasks of program verification, and has been the subject of voluminous 
research. Perhaps the best known, and often used, technique for proving termi¬ 
nation is the ranking function. This is a function p that maps the program states 
into the elements of a well-founded ordered set, such that p(s) > p(s') holds for 
any consecutive states s and s'. This implies termination since infinite descent 
in a well-founded order is impossible. 

We focus on numerical loops, where a state is described by the values of a 
finite set of numerical variables; we consider the setting of integer-valued vari¬ 
ables, as well as rational-valued (or real-valued) variables. We ignore details of 
the programming language; we assume that we are provided an abstract descrip¬ 
tion of the loop as a finite number of alternatives, that we call paths, each one 
defined by a finite set of linear constraints on the program variables x,y,... and 
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the primed variables x',y',... which refer to the state following the iteration. 
The following is such a loop consisting of four paths, Q ±,..., Q4: 

Qi = {x > 0, x' < x - 1, y' = y, z' = zj 

Q.2 = {x > 0, x' < x — 1, y' = y, z > 0, z' < z — 1} 

Q 3 = { x' = x, y > 0 , y' < y - 1 , z > 0 , z' < z - 1 } 

Q 4 = { x' = x, y>0,y'<y-l, z' = z} 

Note that Qi are convex polyhedra. A transition from a state x to x! is possible iff 
(x, x') is a point in some path Qi. We remark that our results hold for arbitrarily- 
complex control-flow graphs (CFGs), we prefer to use the loop setting for clarity. 

A popular tool for proving the termination of such loops is linear ranking 
functions (LRFs). An LRF is a function p{x 1,..., x n ) = aiXi + • • • + a n x n + a 0 
such that any transition (x,x') satisfies (i) p{x) > 0; and (ii) p{x) — p(x') > 1. 
E.g., p(x, y,z) = x is an LRF for a loop that consists of only Qi and Q2 above, 
p(x, y,z) = y is an LRF for Q3 and Q4, and p{x, y,z) = z is an LRF for Q2 and 
Q 3 . However, there is no LRF that satisfies the above conditions for all paths 
Qi, ..., Q4. An algorithm to find an LRF using linear programming (LP) has 
been found by multiple researchers in different places and times and in some al¬ 
ternative versions [Ilflllftl21l2ai26| . Since LP has a polynomial-time complexity, 
most of these methods yield polynomial-time algorithms. These algorithms are 
complete for loops with rational-valued variables, but not with integer-valued 
variables. Indeed, [3] shows loops that have LRFs over the integers but do not 
even terminate over the rationals. In a previous work [3J we considered the integer 
setting, where complete algorithms were proposed and a complexity classification 
was proved: to decide whether an LRF exists is coNP-complete. 

LRFs do not suffice for all loops (e.g., the 4 -path loop above), and thus, a 
natural question is what to do when an LRF does not exist; and a natural answer 
is to try a richer class of ranking functions. Of particular importance is the class 
of lexicographic-linear ranking functions (LLRFs). An LLRF is a d-tuple of affine- 
linear functions, (pi,, pf), required to descend lexicographically. Interestingly, 
Alan Turing’s early demonstration [ 28 j of how to verify a program used an LLRF 
for the termination proof. Algorithms to find LLRFs for linear-constraint loops 
(or CFGs) can use LP techniques, extending the work on LRFs. Alias et al. [L 
extended the polynomial-time LRF algorithm to LLRFs and gave a complete 
solution for CFGs. As for LRFs, the solution is incomplete for integer data, and 
in [ 3 ] we established for LLRFs over the integers results that parallel those for 
LRFs, in particular, to decide whether an LLRF exists is coNP-complete. 

Interestingly, when trying to define the requirements from a numeric “lex¬ 
icographic ranking function” (corresponding to the conditions (Q) and (|nj on 
an LRF, above), different researchers had come up with different definitions. 
In particular, the definition in [T] is more restrictive than the definition in j3j. 
Furthermore, an important paper 011 LLRF generation that preceded both 
works gave yet a different definition. We give the precise definitions in Sect. [ 2 } 
for the purpose of introduction, let us focus on the LLRFs of [ 4 ] (henceforth, 
BMS-LLRFs, after the authors), and illustrate the definition by an example. 

Consider the above loop defined by Qi,..., Q4. A possible BMS-LLRF for 
this loop is p{x , y , z) = (x , y). The justification is this: in Qi and Q2 , the function 
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Pi(x, y) = x is ranking (non-negative and decreasing by at least 1 ). In Q3 and Q4, 
P2(x, y) = y is ranking, while p\ is non-increasing. This is true over the rationals 
and a fortiori over the integers. The following points are important: ( 1 ) for each 
path we have an LRF, which is one of the components of the BMS-LLRF; and ( 2 ) 
previous (lower-numbered) components are only required to be non-increasing 
on that path. Note that this LLRF does not satisfy the requirements of [T[ or [ 3 j. 

The goal of this paper is to understand the computational complexity of some 
problems related to BMS-LLRFs, starting with the most basic problem, whether 
a given loop has such LLRF. We note that . 4 ] does not provide an answer, as 
a consequence of attempting to solve a much harder problem—they consider a 
loop given with a precondition and search for a BMS-LLRF together with a 
supporting linear invariant. We do not know if this problem is even decidable 
when parameters like the number of constraints in the invariants are not fixed 
in advance (when they are, the approach of [ 4 ] is complete, but only over the 
reals, and at a high computational cost - even without a precondition). 

We consider the complexity of finding a BMS-LLRF for a given loop, without 
preconditions. We prove that this can be done in polynomial time when the loop 
is interpreted over the rationals, while over the integers, deciding the existence 
of a BMS-LLRF is coNP-complete. An exponential-time synthesis algorithm is 
also given. These results are similar to those obtained for the previously studied 
classes of LLRFs [ 3 ], but are shown for the first time for BMS-LLRFs. 

Next, we consider the number of components d in a BMS-LLRF (pi,..., pd). 
This number is informally called the dimension of the function. It is interesting 
for several reasons: An upper bound on the dimension is useful for fixing the 
template in the constraint-solving approach, and plays a role in analyzing the 
complexity of corresponding algorithms. In addition, an LLRF can be used to in¬ 
fer bounds on the number of iterations [I] ; assuming linear bounds on individual 
variables, a polynomial bound of degree d is clearly implied, which motivates the 
desire to minimize the dimension, to obtain tight bounds. A smaller dimension 
also means better results when LLRFs are used to guide parallelization [ 14 ] . 

Importantly, the algorithms of Alias et al. [T] and Ben-Amram and Genaim [ 3 ] 
are optimal w.r.t. the dimension, i.e., they synthesize LLRFs of minimal dimen¬ 
sion for the respective classes. We note that it is possible for a loop to have 
LLRFs of all three classes but such that the minimal dimension is different in 
each (see Sect.QJ. We also note that, unlike the case for the previous classes, our 
synthesis algorithm for BMS-LLRFs is not guaranteed to produce a function of 
minimal dimension. This leads us to ask: ( 1 ) what is the best a priori bound 
on the dimension, in terms of the number of variables and paths; and (2) how 
difficult it is to find an LLRF of minimal dimension. As a relaxation of this op¬ 
timization problem, we can pose the problem of finding an LLRF that satisfies 
a given bound on the dimension. Our results are summarized in Table |T| There 
is a striking difference of BMS-LLRFs from other classes w.r.t. to the minimum 
dimension problem: the complexity jumps from PTIME (resp. coNP-complete) 
to NPC (resp. A.f-complete) over rationals (resp. integers). This holds for any 
fixed dimension larger than one (dimension one is an LRF). 
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LLRF type 

Dimension bound 

Existence 

Fixed dimension 

over Q 

over Z 

over Q 

over Z 

ADFG P 

min(ri, k) 

PTIME 

coNP-complete 

PTIME 

coNP-complete 

BG 02 

n 

PTIME 

coNP-complete 

PTIME 

coNP-complete 

BMS g] 

k 

PTIME 

coNP-complete 

NP-complete 

T ,2 -complete 


Table 1 . Summary of results, considering a loop of k paths over n variables. Those in 
the third row are new, the others are from previous works or follow by minor variations. 


2 Preliminaries 

Polyhedra. A rational convex polyhedron V C Q™ (polyhedron for short) is the 
set of solutions of a set of inequalities Ax < b, namely P = {x£ Q n | Ax < b}, 
where A £ Q mx " i s a rational matrix of n columns and m rows, x £ Q n and 
b £ Q m are column vectors of n and in rational values respectively. We say that 
V is specified by Ax < b. We use calligraphic letters, such as V and Q to denote 
polyhedra. For a given polyhedron V C Q” we let I(V) be "PfiZ", i.e., the set of 
integer points of V. The integer hull of V, commonly denoted by Vi, is defined 
as the convex hull of I(V). It is known that Vi is also a polyhedron. An integer 
polyhedron is a polyhedron V such that V = Vi- We also say that V is integral. 

Multipath Linear-Constraint Loops. A multipath linear-constraint loop 
(MLC loop) with k paths has the form: V*=i Aj (x') — c i where x = (xi,..., x n ) T 
and x' = (x[,..., x' n ) T are column vectors, and for q > 0 , Aj £ Q 9 * 2 ™, a £ Q 9 . 
Each path A, (A) < c, is called an abstract transition. The loop is a rational 
loop if x and x' range over Q n , and it is an integer loop if they range over Z". 
We say that there is a transition from a state x £ Q n to a state x' £ Q n , if 
for some 1 < i < k, (A) satisfies the ?’-th abstract transition. In such case we 
say that x is an enabled state. We use x" as a shorthand for a transition (A), 
and consider it as a point in Q 2n . The set of transitions satisfying a particular 
abstract transition is a polyhedron in Q 2n , denoted Qi, namely A^x" < c i. In 
our work it is convenient to represent an MLC loop by its transition polyhedra 
Qi ,..., Qk, which we often write with explicit equalities and inequalities. These 
are sometimes referred to as the paths of the multipath loop. 

Ranking Functions. An affine linear function p : Q n i-» Q is of the form 
p(x) = A • x + Ao where A £ Q" and Ao £ Q. We define Ap : Q 2n i->- Q 
as Ap(x") = p(x) — p(x'). Given a set T C Q 2n , representing transitions, we 
say that p is an LRF for T if for every x" £ T we have @ p(x) > 0; and dn]) 
Ap(x ") > 1. We say that p is an LRF for a rational (resp. integer) loop, specified 
by Qi,..., Qk, when it is an LRF for (J^ =1 Qi (resp. (jf =1 1(Qi))- For a rational 
loop, there is a polynomial-time algorithm to either find an LRF or determine 
that none exists [23] . Its essence is that using Farkas ’ Lemma [251 p. 93], it is 
possible to set up an LP problem whose feasibility is equivalent to the existence 
of p that satisfies @ and El) over Qi,..., Q k - 
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A d-dimensional affine function r : Q n —» Q d is expressed by a d-tuple 
t = (pi, ..., pd), where each component pi : Q n —> Q is an affine linear function. 
The number d is informally called the dimension of r. Next we define when such 
a function is BMS-LLRF [3] for a given rational or integer MLC loop. We then 
compare with ADFG-LLRFs (due to pQ) and BG-LLRFs (due to [3]). 

Definition 1 (BMS-LLRF). Given k sets of transitions T\,... , T), C Q 2n , we 
say that t = (pi, , pa) is a BMS-LLRF for Tf,..., iff for every 1 < £ < k 
there is 1 <i < d such that the following hold for any x" £ T 


-< 

A 

5 

K 

IV 

o 

(i) 

Pi{x) >0, 

(2) 

A°i( x ") > i • 

(3) 


We say that Tg is ranked by p,;. 

We say that r is a BMS-LLRF for a rational (resp. integer) loop, specified by 
Qi, • • ■, Qk, when it is a BMS-LLRF for Qi,...,Qk (resp. I(Qi), ■ ■ ■ ,I(Qk))- It 
is easy to see that the existence of a BMS-LLRF implies termination. 

Definition 2 (BG-LLRF). Given a set of transitions T C Q 2n , we say that 


r = (pi, ..., pd) is a BG-LLRF for 

T iff for 

every x" £ T there is 1 < 

i < d 

such that the following hold: 




Vj <i . 

A Pj (x") 

>0, 

(4) 

Vj < i . 

Pj(x) 

>0, 

(5) 


A Pl (x") 

> 1. 

(6) 


We say that x is ranked by pi. 


We say that r is a BG-LLRF for a rational (resp. integer) loop, specified by 
Qi, • • •, Qk, when it is a BG-LLRF for Q x U • • • U Q k (resp. I(Qi) U • • • U J(Q*)). 
ft is easy to see that the existence of a BG-LLRF implies termination. 

Note the differences between the definitions: in one sense, BG-LLRFs are 
more flexible because of the different quantification — for every transition x” 
there has to be a component pt that ranks it, but i may differ for different 
x", whereas in BMS-LLRFs, all transitions that belong to a certain Ti have 
to be ranked by the same component. In another sense, BMS-LLRFs are more 
flexible because components pj with j < i can be negative (compare 0 with 
(0). Thus, there are loops that have a BMS-LLRF and do not have a BG-LLRF 
(see loop in Sect. [T]) ; and vice versa (see [32 Ex. 2.12]). A third type of LLRFs is 
attributed to [T], hence we refer to it as ADFG-LLRF. It is similar to BG-LLRFs 
but requires all components to be non-negative in every enabled state. That is, 
condition 0 is strengthened. Interestingly, the completeness proof in |1] shows 
that the above-mentioned flexibility of BG-LLRFs adds no power in this case; 
therefore, ADFG-LLRFs are a special case of both BG-LLRFs and BMS-LLRFs. 

The decision problem Existence of a BMS-LLRF deals with deciding whether 
a given MLC loop admits a BMS-LLRF, we denote it by BMS-LexLinRF(Q) 
and BMS-LexLinRF(Z) for rational and integer loops respectively. The corre¬ 
sponding decision problems for ADFG- and BG-LLRFs are solved in [Tj and [3j, 
respectively, over the rationals; the case of integers is only addressed in [3] for 
BG-LLRFs, but the complexity results apply to ADFG-LLRFs as well. 
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Algorithm 1: Synthesizing BMS-LLRFs 

LLRFSYN ((Qi,. . . , Qk )) 
begin 

1 

if (Qi, • • ■, Qk) are all empty then returli nil if Qi ,..., Qk has a 
BMS-QLRF p then 

3 


VI < i < fc. Qi := 0 if Qi is ranked by p, otherwise Q[ = Qi 

4 


r 4— LLRFSYN ((Qi,..., Qk)) 

5 


if None then return p::r 

6 

return None 


3 Synthesis of BMS-LLRFs 

In this section we describe a complete algorithm for synthesizing BMS-LLRFs 
for rational and integer MLC loops; and show that the decision problems BMS- 
LexLinRF(Q) and BMS-LexLinRF(Z) are PTIME and coNP-complete, re¬ 
spectively. We assume a given MLC loop Qi,..., Qk where each Qi is given as a 
set of linear constraints, over 2 n variables (n variables and n primed variables). 

Definition 3. Let T \,..., T/. be sets of transitions such that Ti C Q 2n . We say 
that an affine linear function p is a BMS gwasz-LRF (BMS-QLRF for short) for 
Ti,..., Tk if every transition x" G T\ U ■ ■ ■ U Tfe satisfies Ap(x") > 0, and for at 
least one Te, p is an LRF (such Te is said to be ranked by p). 

Example 1. The following are BMS-QLRFs for the loop consisting of Q \,..., Q 4 
presented in Sect. [1] fi(x, y, z)=x, which ranks {Qi,Q. 2 }', f 2 {x,y, z)=y which 
ranks {Q 3 , £> 4 }; and f 3 (x,y,z)=z which ranks {Q 2 , Qz}- 

Lemma 1. There is a polynomial-time algorithm that finds a BMS-QLRF p, if 
there is any, for Qi, ■ ■ ■, Qk- 

Proof. The algorithm iterates over the paths Qi, ■ ■ ■, Qk- In the i-th iteration 
it checks if there is an LRF p for Qi that is non-increasing for all other paths, 
stopping if it finds one. The algorithm makes at most k iterations. Each iteration 
can be implemented in polynomial time using Farkas’ Lemma (as in |23j). □ 

Our procedure for synthesizing BMS-LLRFs is depicted in Alg. [0 In each 
iteration (i.e., call to LLRFSYN): it finds a BMS-QLRF p for the current paths 
(Line[2|); it eliminates all paths that are ranked by p (Line[3]); and calls recursively 
to handle the remaining paths (Line [4]). The algorithm stops when all paths are 
ranked (Line |T]) , or when it does not find a BMS-QLRF (Line|6|. 

Example 2. Consider the MLC loop example in Sect. |T| Procedure LLRFSYN is 
first applied to (Qi, Q 2 , Q 3 , Qi), and at Line [ 2 ] we can choose the BMS-QLRF 
x which ranks Qi and Q 2 ■ Hence these are eliminated at Line [3] and at Line 0] 
LLRFSYN is applied recursively to (0, 0, Q 3 , Q 4 ). Then at Line[2]we can choose the 
BMS-QLRF y which ranks Q 3 and Q 4 . The next recursive call receives empty 
polyhedra, and thus the check at Line|T]succeeds and the algorithm returns (x, y). 
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Lemma 2. //LLRFSYN((Qi,..., Qk)) returns r different from None, then r is 
a BMS-LLRF for the rational loop Qi ,..., Qk- 

The proof of the above lemma is straightforward. Thus, Alg. |T| is a sound 
algorithm for BMS-LLRFs. The following proposition shows completeness. 

Proposition 1. There is a BMS-LLRF for Qi,... ,Qk if and only if every sub¬ 
set of {Qi ,..., Qk} has a BMS-QLRF. 

Proof. The “if” direction is implied by the LLRFSYN procedure, in such case it 
will find a BMS-LLRF. For the “only if” direction, let r = (pi,..., pf) be a 
BMS-LLRF for Qi,..., Qk, and let Qg lt ..., Qi j be an arbitrary subset of the 
loop’s paths. Since r is a BMS-LLRF for Qi,..., Qk, each Qe i is ranked by some 
pi t . Let / = min{/i,... ,lj}, then pi is a BMS-QLRF for Qa x , ..., Qi r □ 

Lemma 3. Procedure LLRFSYN can be implemented in polynomial time. 

Proof. Procedure LLRFSYN makes at most k steps (since at least one path is 
eliminated in every step). Further, all steps are elementary except checking for 
a BMS-QLRF which can be done in polynomial time as stated by Lemma [L] □ 

Corollary 1. BMS-LexLinRF(Q) € PTIME. 

So far we have considered only rational loops, next we consider integer loops. 
Lemma 4. There is a complete algorithm for synthesizing a BMS-QLRF for 

l(Qi),...,I(Qk). 

Proof. The algorithm computes the integer hull Qu ,..., Qki, and then proceeds 
as in the rational case (Lemma [1]). Correctness follows from the fact that for in¬ 
tegral polyhedra the implied inequalities over the rationals and integers coincide, 
i.e., Qu ,..., Qki and I{Qi), ■ ■ ■ ,I(Qk ) have the same BMS-QLRFs. □ 

Lemma 5. When procedure LLRFSYN is applied to the integer hulls Qu ,..., Qki, 
it finds a BMS-LLRF for I(Qi),..., I(Qk), if one exists. 

Proof. Soundness follows from the fact that Qi contains I{Q); for completeness, 
note that: (i) Prop. CD holds also for integer loops; and (ii) Line [3] of LLRFSYN 
does not change the transition polyhedra, it only eliminates some, which means 
that they remain integral throughout the recursive calls. Thus, in each iteration 
the check at Line [2] is complete (see Lemma HJ). □ 

In the general case this procedure has an exponential time complexity since 
computing the integer hull requires an exponential time. However, for special 
cases in which the integer hull can be computed in polynomial time [5J Sect. 4] it 
has polynomial time complexity. The following lemma implies (assuming P^NP) 
that the exponential time complexity is unavoidable in general. 

Theorem 1. BMS-LexLinRF(Z) is a coNP-complete problem. 

Proof. The coNP-liardness follows from the reduction in [3, Sect. 3.1], since it 
constructs a loop that either does not terminate or has an LRF. The inclusion 
in coNP is based on arguments similar to those in ,3] Sect. 5]; briefly, we use the 
generator representation of the transition polyhedra to construct a polynomial- 
size witness against existence of an LLRF (see App. EJ. □ 
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4 The Dimension of BMS-LLRFs 


Ben-Amram and Genaim [3] Cor. 5.12, p. 32] showed that if a given MLC loop 
has a BG-LLRF, then it has one of dimension at most n, the dimension of the 
state space. The same proof can be used to bound the dimension of ADFG- 
LLRFs by n as well. Hence for ADFG-LLRFs the bound min (n,k) holds (k is 
the number of paths), due to the fact that associating LLRF components with 
paths is no loss of generality for ADFG-LLRFs jTj. In the case of BMS-LLRFs, 
the bound k clearly holds, and the next example shows that it is tight. 


Example 3. Define an MLC loop Qi,...,Qk for some k > 0, over variables x, y, 
where each Q t = (a/ < x, x' + i ■ y' < x + i ■ y — 1, x + i ■ y > 0}. Define 
fi(x,y) = x + i ■ y. It is easy to check that (i) /) is an LRF for Q,. and is non¬ 
increasing for any Qj with i < j < k; and (ii) there are no distinct Qi and Qj 
that have a common LRF. From Q it follows that (/i,..., /*,) is a BMS-LLRF 
for this loop, and from flu]) it follows that any BMS-LLRF must have (at least) 
dimension k, since different paths cannot be ranked by the same component. We 
remark that this loop has no BG-LLRF (hence, also no ADFG-LLRF). 


The above discussion emphasizes the difference between the various defini¬ 
tions of LLRFs, when considering the dimension. The next example emphasizes 
this difference further, it shows that there are loops, having LLRFs of all three 
kinds, for which the minimal dimension is different according to each definition. 
This also means that the implied bounds on the number of iterations (assuming, 
for simplicity, that all variables have the same upper bound) are different. 


Example 4- Consider an MLC loop specified by the following paths 


Qi = < 

r r > 0, 

l r' < r, 


t > 0, 
t' < t. 

0.2 = < 

r r > 0, 
l r' = r, 

s > 0, 
s' < s, 

t > 0, 
t' < t 

Qz = < 

( r> 0, 
l r' = r, 

s > 0, 
s' = s, 

f 

= t 

Qi = < 

f r> 0, 
l r' = r, 

s > 0, 
s' = s, 

t’ 

= t 

Qz = < 

f r> 0, 
l r' = r, 

s > 0, 
s' = s, 

t’ 

= t 


x > 0, 


z > 0, 

W > 0, 

x > 0, 


2 > 0, 

w > 0, 

x > 0, 
x' < x, 


z > 0, 

w > 0, 

x > 0, 

y > o, 

2 > 0, 

w > 0, 

x' = x, 

y' < y , 

z' < z , 


x > 0, 

y> o, 

2 > 0, 

w > 0, 

x' = X, 

y' < y , 

z' = 2 , 

w' < w 


where, for readability, we use < for the relation “smaller at least by 1”. This 
loop has the BMS-LLRF (t,x,y), which is neither a BG-LLRF or ADFG-LLRF 
because t is not lower-bounded on all the paths. Its shortest BG-LLRF is of 
dimension 4, e.g., (r,s,x,y), which is not an ADFG-LLRF because y is not 
lower-bounded on all the paths. Its shortest ADFG-LLRF is of dimension 5, 
e.g., (r, s, x , z, w). This reasoning is valid for both integer and rational variables. 


Next, we consider the problem of minimal dimension. We ask (1) whether 
our algorithms return an LLRF with minimal dimension; and (2) what do we 
gain (or lose?) in terms of computational tractability if we fix a bound on the 


dimension in advance. Importantly, the algorithms of m are optimal w.r.t. the 
dimension, i.e., they synthesize LLRFs of minimal dimension. In both cases the 
optimal result is obtained by a greedy algorithm, that constructs the LLRF by 
adding one dimension at a time, taking care in each iteration to rank as many 
transitions as possible. The next example shows that a greedy choice in Alg. |T] 
fails to guarantee optimality, for both rational and integer loops. Intuitively, 
the greedy approach worked in hei because the classes of quasi-LRFs used to 
construact LLRFs are closed under conic combinations, so there is always an 
optimal choice that dominates all others. This is not true for BMS-QLRFs. 

Example 5. Consider the MLC loop of Sect. |T| If at Line [ 2 ] Alg. |T] we seek a 
BMS-QLRF that ranks a maximal number of the paths, we can use any of those 
derived in Ex. [TJ /i = a;; /2 = y ; or f 3 = z. However, these alternatives lead to 
BMS-LLRFs of different dimensions: (i) choose f\ to rank {Qi, Q 2 }, and then / 2 
to rank {Q 3 , Q 4 }. (ii) choose / 2 to rank {Q 3 , Q 4 }, and then / 4 to rank {Q 4 , Q 2 }. 
(iii) choose f 3 to rank {Q 2 , Q 3 }, but then there is no single function that ranks 
{Qi,Qa}- Take /1 to rank Qi and then / 2 to rank Q 4 . The dimension of the 
BMS-LLRF in the first two cases is 2, and in the last one it is 3. 

Since Alg. |T] is not guaranteed to find a BMS-LLRF of minimal dimension, 
it is natural to ask how hard is the problem of finding a BMS-LLRF of minimal 
dimension? This can be posed as a decision problem: does a given MLC loop have 
a BMS-LLRF with dimension at most dl This decision problem is denoted by 
BMS-LEXLiNRF(d, Q) and BMS-LEXLiNRF(d, Z) for rational and integer loops 
respectively. Note that d is a constant, however, it will be clear that accepting 
d as an input does not change the complexity class of these problems. Also note 
that for d, = 1 it is just the LRF problem. Similar problems can be formulated 
for ADFG- and BG-LLRFs, of course. In these two settings, the imposition of a 
dimension bound does not change the complexity class. 

Theorem 2. Given a rational MLC loop, and d > 1, it is possible to determine 
in polynomial time if there is an ADFG-LLRF (resp. BG-LLRFsJ for the loop 
of dimension at most d. For integer MLC loops, the problem is coNP-complete. 

Proof. The case of rational loops is straightforward since the corresponding syn¬ 
thesis algorithms find LLRFs with minimal dimension, and are in PTIME. The 
integer case follows easily from the techniques of [3) (see App. 0 . □ 

5 Complexity of BMS-LexLinRF(eZ, Q) 

In this section we show that BMS-LExLiNRF(d, Q) is NP-complete. 

Theorem 3. For d > 2, BMS-LExLiNRF(<i, Q) is an NP-complete problem. 

For inclusion in NP, a non-deterministic algorithm for the problem works as 
follows. First, it guesses a partition of {1 ,... ,k} into d sets J\ ,..., Jd , of which 
some may be empty (we can assume they are last). Then it proceeds as in Alg. [T] 
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but insists that the paths indexed by J r be ranked at the r-th iteration. This 
may fail, and then the algorithm rejects. If a BMS-LLRF of dimension at most 
d exists, there will be an accepting computation. 

For NP-hardness we reduce from the NP-complete problem d-Colorability of 
3-Uniform Hypergraphs [20122] . An instance of this problem is a set H of m sets 
Fi,... ,F m (hyperedges, or “faces”), where each F l includes exactly 3 elements 
from a set of vertices V = {1,..., n}, and we are asked whether we can choose 
a color (out of d colors) for each vertex such that every face is not monocolored. 

We construct a rational MLC loop in 3 m variables and n paths. The variables 
are indexed by vertices and faces: variable x.- h j corresponds to i 6 F :j £ H . For 


each vertex 1 < t < n we define Qi as a conjunction of the following: 

y: Xi,k - yy x' i}k > 1 (7) 

k: k : i^F^. 

I] xj,k- yy xfk > 0 for all vertex j ^ i (8) 

k: jeF k k: j£F k 

Xi,k > 0 for all face F k s.t. i G F k (9) 

Xj,k > 0 for all vertex j and face F k s.t. j G Fk A i ^ Fk (10) 

Xi : k + Xj : k > 0 for all vertex j ^ i and face F k s.t. i,j G Fk (11) 


We claim that a rational loop that consists of these n paths has a BMS-LLRF 
of dimension d iff there is a valid d-coloring for the vertices V. 

Assume given a d-coloring, namely a division of the vertices in d disjoint sets 
V = C i U • ■ • U Cd , such that the vertices of each C t are assigned the same color. 
We construct a BMS-LLRF (gi, ..., gf) such that gt ranks all paths Qi with 
i G C(. We assume that each Ct is non-empty (otherwise we let <^(x) = 0). 

We start with C\. For each F k G H , define a function fk as follows: if Fk fl 
Ci = 0 we let fk (x) = 0; if F k fl C\ = {*} we let /fc(x) = Xiy, and if Fk fl C\ = 
{i,j} we let fk (x) = Xi tk + Xj,k- We claim that <71 (x) = fk is a BMS-QLRF 
for Qi,..., Q n that ranks all paths Qi with iGCi, which we justify as follows: 

1. g i is non-increasing on all Qj, and decreasing for each Qi with i G C\. 
To see this, rewrite g(x) as YhieCi Yhk - t,eF k x t,k- As each inner sum is non¬ 
increasing by (17151) . we conclude that g\ is non-increasing on all paths. More¬ 
over, for i G Ci, the sum ieF k x hk appears in g i and is decreasing ac¬ 
cording to 0 , thus g\ is decreasing for each Q, with i G Ci. 

2. g\ is non-negative for all Qi with i G Ci, because all f k are non-negative 
on these paths. To see this, pick an arbitrary j G Ci and an arbitrary face 
F k '. if i G F k , and it is the only vertex from C\ in F k , then /fc(x) = x^ k is 
non-negative on Qi by if i G Fk but there is another vertex j G C\ in 
Fk, then /fc(x) = Xi tk + Xj tk is non-negative on Qi by (fill) : if i £ F k , then 
for any j G F k we have Xj >k > 0 by m, and then /),- is non-negative since it 
is a sum of such variables. Note that g\ can be negative for Qj with j ft C\. 

Similarly, we construct BMS-QLRFs g 2 , ■ ■ ■ ,gd such that ge ranks Qi for i G Ct. 
Clearly (gi,..., gd) is a BMS-LLRF for this loop. 

Now suppose we have a BMS-LLRF of dimension d; we analyze what paths 
Qi can be associated with each component, and show that for any face F k , the 
three paths that are indexed by its vertices, i.e., Qi for * G F k , cannot be all 
associated with the same component. Which clearly yields a d-coloring. 
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Suppose that for some face Fk = {* 1 , 125 * 3 }, the paths Q tl , Qi 2 and Qi 3 are 
associated with the same component, i.e., all ranked by the same function, say 
g. Thus Ag(x.") > 1 must be implied by the constraints of Q,,, Q i2 and Qi 3 , 
independently. Now since, in each path, the only constraint with a non-zero free 
coefficient is 0 , it follows that the coefficients of variables Xi lt k, %i 2 ,k and Xi 3t k 
in g(x) are positive, i.e., g(x) = aq ■ x ily k + «2 • x i2t k + 03 ■ x i3i k + h(x) where 
h(x) is a combination of other variables, and 01 , 02,03 > 0. Similarly, g(x) > 0 
must be implied by the constraints of each of three paths independently. For 
this to hold, g must be a positive linear combination of functions constrained 
to be 11011 -negative by these paths, and do not involve primed variables. Now 
consider variables Xi lt k, Xi 2t k and aq 3 i fc, and note that they participate only in 
the following constraints in Q ix (left), Q , 2 (middle) and Q , 3 (right): 

X ilt k > 0 Xi 2ik > 0 Xi 3 ,k > 0 

Xi 3: k T Xi 2j k ^ 0 Xi 3: k T Xi 2 ,k ^ 0 %i 2 ,k T Xi 3: k ^ 0 

Xi 3: k T Xi 3j k ^ 0 Xi 2: k T Xi 3j k 0 Xi 3j k T Xi 3: k 0 

This means that the corresponding coefficients in g , i.e., a = (a i 02 03 ), must 
be equal to linear combinations of the corresponding coefficients in the above 
constraints. Namely, there exist 61 ,..., 69 >0 such that 

(1 0 0\ (0 1 0\ /0 0 1\ 

0 = ( 6 i 62 63 ) • ( 1 1 oj a= (64 65 6 e ) • ( 1 1 0 1 a =>. (b 7 b 8 b 9 ) ■ ( 0 1 1 1 

From these nine equations, and the constraints bi > 0 for all *, we necessarily 
get c*i = a 2 = 03 = 0 , which contradicts 01 , 02,03 > 0 as we concluded before, 
and thus paths corresponding to {*i,* 2 ,* 3 } of Fk cannot be all associated with 
the same component. This concludes the proof of Th. [3] 

6 Complexity of BMS-LexLinRF(d, Z) 

In this section we turn to the problem BMS-LexLinRF(c?, Z), and show that it 
is harder than BMS-LexLinRF(c?, Q), specifically, it is IFf-complete. The class 
is the class of decision problems that can be solved by a standard, non- 
deterministic computational model in polynomial time assuming access to an 
oracle for an NP-complete problem. I.e., XVf = NP np . This class contains both 
NP and coNP, and is likely to differ from them both (this is an open problem). 

Theorem 4. For d > 2, BMS-LExLiNRF(d, Z) is a Tif -complete problem. 

The rest of this section proves Th. [I] For inclusion in we use a non- 
deterministic procedure as in the proof of Th. [3} Note that the procedure needs 
to find (or check for existence of) BMS-QLRFs over the integers, so it needs 
a coNP oracle. For i7.f-hardness we reduce from the canonical -complete 
problem (follows from [5TJ Th. 4.1]): evaluation of sentences of the form 

...X n VX n+1 ... X 2n -,0(X!,..., X 2n ) (*) 

where the variables Xj are Boolean and the formula <f> is in 3CNF form. Thus, 
<f> is given as a collection of m clauses, Ci,, C m , each clause Ci consisting of 
three literals G {Xi ,..., X 2ni ->Xi ,..., -'X 2ra }, 1 < j < 3. The reduction is 
first done for d = 2 , and later extended to d > 2 as well. 
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Let us first explain a well-known approach for reducing satisfiability of a 
Boolean formula <j> to satisfiability of integer linear constraints. We first associate 
each literal Lj with an integer variables Xij. Note that the same Boolean variable 
(or its complement) might be associated with several constraint variables. Let 
C be the set of (1) all conflicting pairs, that is, pairs (( i,j ), (r, s)) such that L\ 
is the complement of L*; and (2) pairs ( i,j')) with 1 < j < j' < 3, i.e., 

pairs of literals that appear in the same clause. We let J 7 be a conjunction of the 
constraints: Xij + x r , s < 1 for each (( i,j ), (r, s)) £ C; and 0 < Xij < 1 for each 
1 < i < m and 1 < j < 3. An assignment for X{j that satisfies F is called a non- 
conflicting assignment , since if two variables correspond to conflicting literals 
(or to literals of the same clause) they cannot be assigned 1 at the same time. 
The next Lemma relates integer assignments with assignments to the Boolean 
variables of (*). Given a literal L , i.e., X v or ~>X V , we let lsum(L) be the sum 
of all Xij where Ll = L (we use 0 and 1 for false and true). 

Lemma 6 . (A) If a is a satisfying assignment for <j>, then there is a non¬ 
conflicting assignment for F such that (1) xq i +£*,2 + Xq 3 = 1 for all 1 < i < to; 

(2) cr(X v ) = 1 =>■ lsum(-iX„) = 0; and (3) a(X v ) = 0 =>• lsnm(X„) = 0. (B) If 
(j> is unsatisfiable, then for any non-conflicting assignment for F there is at least 
one 1 < i < to such that Xqi + Xq 2 + xq 3 = 0 . 

Proof. (A) If a satisfies <j>, we construct a satisfying assignment for F: first every 
Xij is assigned the value of Lj, and then we turn some Xjj from 1 to 0 so that 
at most one variable of each clause is set to 1. Since we only turn Is to Os, 
when cr(X v ) = 1 (resp. a(X v ) = 0) all constraint variables that correspond to 
-<X V (resp. X v ) have value 0, and thus lsum(-W„) = 0 (resp. lsum(X„) = 0). 
(B) If F has a non-conflicting assignment in which Xij + x t j + Xi .3 = 1 for all 
1 < i < to, then we can construct a satisfying assignment a for </> in which cr(X v ) 
is max ({xj^jL* = X v } U {1 — %i,j\Lj = _i A t ,}), so <j> is satisfiable. □ 

Next we proceed with the reduction, but first we give an outline. We build 
an integer loop, call it F. with 2 ?r + 2 abstract transitions: 2 n transitions named 
F v , a , for 1 < v < n and a £ {0,1}; plus two named <P and 12. These are defined so 
that existence of a BMS-LLRF {fi^ff) for T implies: (1) l P v .o and \P v> i, for each 
1 < v < n, cannot be ranked by the same /,;, and the order in which they are 
ranked will represent a value for the existentially-quantified variable X v ; (2) <P 
cannot be ranked by / 1 , and it is ranked by /2 iff \/X n+ i... X 2 n _, 0(Ai,..., X 2 n ) 
is true assuming the values induced for Xi,..., X n in the previous step; and 

(3) 12 is necessarily ranked by /j, its only role is to force to be ranked by f- 2 - 
All these points will imply that (*) is true. For the other direction, if (*) is true 
we show how to construct a BMS-LLRF (/ 1 , /-j) for T. Next we formally define 
the variables and abstract transitions of T, and prove the above claims. 

Variables: Loop T includes 4TO+2n+l variables: (1) every literal Ll contributes 
a variable Xij\ ( 2 ) for each 1 < * < to, we add a control variable xqo which is used 
to check if clause G,; is satisfied; (3) for each 1 < v < n, we add variables z Vi 0 and 
z v j which help in implementing the existential quantification; and (4) variable 
w, which helps in ranking the auxiliary transition 12 . 
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Transitions: First we define T>, the transition that intuitively checks for satis¬ 
fiability of (j){X i,..., X 2 „). It is a conjunction of the following constraints 
0 < Xij < 1 A x'ij = Xij for all 1 < i < m, 1 < j < 3 (12) 

Xij + X r ,s < 1 for all ( r , s)) £ C (13) 

Xi ,0 > 0 A x'ifi = Xi,o + Xi, 1 + Xi ,2 + Xi ,3 — 1 for all 1 < i < m (14) 

z v ,o > 0 A z' V}0 = z v fi — lsum(A'„) for all 1 < v < n (15) 

Zv,i > 0 A z' V}1 = z v ,i — lsum(-iX„) for all 1 < v < n (16) 

w = w (17) 

Secondly, we define 2 n transitions which, intuitively, force a choice of a Boolean 
value for each of A'i,... ,X n . For 1 < v < n and a £ {0,1}, transition T v<a is 
defined as a conjunction of the following constraints 


Zv,a ^ 0 A Z v a — Z'v,a 1 


(18) 

%u,b ^ 0 

for all 1 < u < n, b £ { 0 , 1 }, 

(19) 

/ _ 

%u,b %u,b 

for all 1 < u < n, 6 £ ( 0 , 1 }, ( u , b) 7 ^ (v , 0 ) 

( 20 ) 

x'i# > 0 A x'i t o = Xi,o 

for all 1 < i < m 

( 21 ) 

w > 0 A w' = w 


( 22 ) 


Finally we define the abstract transition 17, which aids in forcing a desired form 
of the BMS-LLRF, and it is defined as a conjunction of the following constraints 
w > 0 A w' = w — 1 (23) 

z u ,b > 0 A Zu,b = z u ,b for all 1 < u < n, b £ {0, 1} (24) 

Now, we argue that in order to have a two-component BMS-LLRF for T, the 
transitions have to be associated to the two components in a particular way. 

Lemma 7. Suppose that (/i,/ 2 ) is a BMS-LLRF /or T. Then, necessarily, the 
correspondence between the BMS-LLRF components and transitions is as fol¬ 
lows: (i) 17 is ranked by f\; (ii) is ranked by f^; (in) for 1 < v < n, one of 
d/yfi and \T Vy i is ranked by f±, and the other by fa. 

Proof. An LRF for 17 must involve w, since it is the only decreasing variable, 
and cannot involve any Xij since they change randomly. Similarly, an LRF for <P 
cannot involve w as it has no lower bound, and it must involve at least one x. c j 
since no function that involves only z Vja variable(s) decreases for an initial state 
in which all Xij are assigned 0. Note that such LRF cannot be non-increasing for 
17 since Xij change randomly in 17. Thus, we conclude that 17 must be associated 
with fi and T> with f^. For the last point, for each 1 < v < n, transitions \P Vt o and 
\T Vt i must correspond to different positions because variables that descend in one 
(namely z„ >a of 'Tv,a) are not bounded in the other (since (1191) requires u^v). □ 

Lemma 8. A BMS-LLRF of dimension two exists for T iff (*) is true. 

Proof. Assume that a BMS-LLRF (/ 1 , ff) exists for T, we show that (*) is true. 
By Lemma [7] we know how the transitions are associated with the positions, up 
to the choice of placing and 'T v ,\. for each 1 < v < n. Suppose that, for each 
1 < v < n, the one which is associated with fa is i.e., a v £ {0,1}, and 

let d v be the complement of a v . By construction we know that: (i) in 'T v ,a v the 
variables z v ,s„ and Xij with j > 1 change randomly, which means that fa cannot 
involve them; and (ii) in T> the variable w is not lower bounded, which means 
that fa cannot involve w. Since these transitions must be ranked by fa, we can 
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assume that /2 has the form / 2 (x, z, w ) = Ci-Xi t o + Y^ v Cv ' where c* and 
c v are non-negative rational coefficients. We claim that (*) is necessarily true; 
for that purpose we select the value a v for each X v . and next we show that this 
makes it is impossible to satisfy ... , X 2ra ). Assume, to the contrary, that 

there is a satisfying assignment a for <j>, such that a(X v ) = a v for all 1 < v < n. 
By Lemma [ 6 ] we know that we can construct an assignment to the variables 
Xij such that (i) x^i + Xi^ + Xi t 3 = 1 , for each 1 < i < m, which means that 
x\ o = Xi, 0 at m ; and (ii) for each 1 < v < m, if a v = 0 (resp. a v = 1), then 
lsum(A t ,) = 0 (resp. lsum(-iA„) = 0), which means that z' v a = z Vt a v at (1151) 
(resp. (USD). Hence fi as described above does not rank <d> since none of its 
variables change, contradicting our assumption. We conclude that (■*•) is true. 

Now assume that (*) is true, we construct a BMS-LLRF of dimension two. 
The assumption means that there are values a ±,..., a n for the existentially- 
quantified variables to satisfy the sentence. Let /i(x, z, w) = w + X™ = 1 z Vt a v and 
/ 2 (x, z,w) = z v,a v - We claim that (/i,/ 2 ) is a BMS-LLRF such 

that: (i) f± is an LRF for 17 and { [ / v .a , v , and non-increasing for and <!>; 

and (ii) fi is an LRF for { 1 / Vi0v and All this is easy to verify, except possibly 
that fi is an LRF for for which we argue in more detail. By assumption, 
<f>(a 1 ,..., o„, X n +i ,..., X 2 n ) is unsatisfiable. Consider a state in which is en¬ 
abled; by (1121131) . this state may be interpreted as a selection of non-conflicting 
literals. If one of the selected literals does not agree with the assignment chosen 
for X\,... ,X n , then by (1151161) the corresponding variable z v . (lv is decreasing. 
Otherwise, there must be an unsatisfied clause, and the corresponding variable 
Xifi is decreasing. All other variables involved in /2 are non-increasing, all are 
lower bounded, so fi is an LRF for <P. □ 

E 2 —hardness of BMS-LEXLiNRF(d, Z) for d= 2 follows from Lemma |U For 
d > 2, we add to T additional d — 2 paths as those of Ex. [3j and to each original 
path in T we add x'=x and y'=y (x, y are used in Ex.0. Then, the new loop has 
a BMS-LLRF of dimension d iff (*) is true. This concludes the proof of Th. [I] 

7 Related Work 

LLRFs appear in the classic works of Turing [2S] and Floyd m- Automatic 
generation of LRFs and LLRFs for linear-constraint loops begins, in the context 
of logic programs, with Sohn and van Gelder |26j . For imperative programs, it 
begins with Colon and Sipma U- The work of Feautrier on scheduling 113114) 
includes, in essence, generation of LRFs and LLRFs. All these works gave al¬ 
gorithms that yield polynomial time complexity (inherited from LP), except 
for Colon and Sipma’s method which is based on LP duality and polars. The 
polynomial-time LP method later reappeared in (21123) . These methods are com¬ 
plete over the rationals and can be used in an integer setting by relaxing the 
loop from integer to rational variables, sacrificing completeness. This complete¬ 
ness problem was pointed out (but not solved) in (21124) . while (11)13) pointed 
out the role of the integer hull in ensuring completeness. Bradley et al. [6] use a 
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bisection search over the space of coefficients for inferring LRFs over the integers, 
which yields completeness at exponential cost (as argued in 0 ). 

Alias et al. I] extended the LP approach to LLRFs, obtaining a polynomial¬ 
time algorithm which is sound and complete over the rationals (for their notion of 
LLRF). The (earlier) work of Bradley et al. 0 introduced BMS-LLRFs and used 
a “constraint-solving method” that finds such LLRFs along with supporting in¬ 
variants. The method involves an exponential search for the association of paths 
to LLRF components, and is complete over the reals. Subsequent work used more 
complex extensions of the LLRF concept Ml- Harris et al. m demonstrate that 
it is advantageous, to a tool that is based on a CEGAR loop, to search for LLRFs 
instead of LRFs only. The LLRFs they use are BMS-LLRFs. Similar observations 
have been reported in p2] (also using BMS-LLRFs), [8j (using ADFG-LLRFs) 
and [TQ] (using a an iterative construction that extends BMS-LLRFs). Heizmann 
and Leike m generalize the constraint-based approach by defining the concept 
of a “template” for which one can solve using a constraint solver. They also 
provide a template for ADFG-LLRFs (of constant dimension). Ben-Amram [2] 
shows that every terminating monotonicity-constraint program has a piecewise 
LLRF of dimension at most 2 n. Piecewise LLRFs are also used in [29], with no 
completeness result, there they are inferred by abstract interpretation. 


8 Conclusion 

This work contributes to understanding the design space of the ranking-function 
method, a well-known method for termination analysis of numeric loops, as 
well as related analyses (iteration bounds, parallelization schedules). This design 
space is inhabited by several kinds of “ranking functions” previously proposed. 
We focused on BMS-LLRFs and compared them to other proposals of a similar 
nature. We characterized the complexity of finding, or deciding the existence of, 
BMS-LLRF for rational and integer MLC loops. We also compared these three 
methods regarding the dimension of the LLRF, and the complexity of optimizing 
the dimension, which turns out to be essentially harder for BMS-LLRFs. Given 
our reductions, it is easy to show that it is impossible to approximate the mini¬ 
mal dimension of BMS-LLRFs, in polynomial time, within a factor smaller than 
|, unless P=NP for rational loops, and for integer loops (see Ann. O). 

We conclude that none of the three methods is universally preferable. Even 
ADFG-LLRFs, which in principle are weaker than both other methods, have an 
advantage, in that the algorithm for computing them may be more efficient in 
practice (due to solving smaller LP problems). If this is not a concern, they can 
be replaced by BG-LLRFs, so we are left with two, incomparable techniques. 
This incomparability stems from the fact that BG-LLRFs and BMS-LLRFs re¬ 
lax the restrictions of ADFG-LLRFs in two orthogonal directions: the first in 
quantifying over concrete transitions rather than abstract ones, and the second 
in allowing negative components. By making both relaxations, we get a new type 
of LLRF 19], which is as in Def. [2] but relaxing condition ([5]) to hold only for 
j = i, but for which the computational complexity questions are still open. 
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A BMS-LexLinRF(Z) is coNP-complete 


The coNP-hardness follows from the reduction in [3] Sect. 3.1], since it constructs 
a loop that either does not terminate or has an LRF. Next we prove inclusion 
in coNP by showing that the complement problem, i.e., the nonexistence of a 
BMS-LLRF, has a polynomially checkable witness. We assume a given MLC loop 
Qi,...,Qk where each Qp is given as a set of linear constraints, over 2 n variables 
(n variables and n primed variables). In this appendix we assume familiarity with 
Section 2.1 of [3] (preliminaries on polyhedra). 

Recall that Proposition |I] when applied to /(Qi),..., I(Qk), implies that 
I{Qi), ■ ■ ■ ,I{Qk) has no BMS-LLRF iff there is a subset of the transition poly¬ 
hedra that has no BMS-QLRF. This suggests that this subset can be used as 
a witness for the nonexistence of a BMS-LLRF. However, checking that such a 
subset has no BMS-QLRF cannot be done in polynomial time using the Algo¬ 
rithm of Lemma 0] since it requires computing the corresponding integer hull, 
and thus cannot be directly used as a witness. Instead, we show that there is fi¬ 
nite set of integers points, related to this subset of the transition polyhedra, that 
can witness the nonexistence of a BMS-QLRF, and, moreover, can be checked 
in polynomial time (by checking that some corresponding set of constraints has 
no solution, over the rationals). Without loss of generality, assume that the sub¬ 
set of the transition polyhedra that we are considering, for the nonexistence of 
BMS-QLRF, is I(Qi), ■ ■ • ,I(Qe) for some £ < k. 

We first show that there is a polynomially checkable witness for the nonex¬ 
istence of a BMS-QLRF for I{Q \),..., I{Qi) that ranks a specific I(Q P ) for 
1 < p < £ — we refer to such BMS-QLRF as BMS—QLRF(p). Then we use this 
witness to construct one for the non-existence of BMS-QLRF. 

Definition 4. Let X = Xi U • • • U X/, Y = Yi U • • • U Yp and 1 < p < £, such 
that (a) W C I(Qi); ( b) Y t C I{lZ Qi ); (c) Y t ± 0 => X t ± 0; and (d) X p ^ 0. 
We say that (X, Y) is a witness against the existence of a BMS—QLRF(p) for 
J(Qi),... ,I(Qp) if the following set of linear constraints has no solution 


A-x ~1- Aq ^ 0 

for all x" £ X p 

(25a) 

X 

1 

IV 
\ — 1 

for all x" £ X p 

(25b) 

X 

1 

IV 

o 

for all x" £ Xi (i ^ p) 

(25c) 

A-y > 0 

for all y" £ Y p 

(25d) 

IV 

o 

for all y" £ Y t V* 

(25e) 


The variables in the above constraints are Ao,A, and they are rational-valued. 

Lemma 9. Let X = Xi U • • • U Xp, Y = Yi U • • • U Yp and 1 < p < £ be as in 
Definition^ ] Then ,I{Qp) has no BMS—QLRF(p). 

Proof. Assume the contrary, i.e., there is (Ao,A) £ Q n+1 such that p(x) = A • 
x + Aq is a BMS—QLRF(p) for J(Qi),-- - ,I(Qp). By assumption, (125al) - (125cl) 
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has no solution, hence, they are not satisfied by the specific (Ao, A) that we have 
chosen above. But (I25al) - (125cl) are clearly satisfied because p is a BMS—QLRF(p), 
and thus one of (I25dl) or (125cl) is not satisfied. We reason on these two cases 
separately. 

Case 1: Suppose (125cD is not satisfied, for some y" £ Y p . That is, A-y < 0. Choose 
x" £ X p , and note that for any integer a > 0, the integer point z" = x" + a ■ y" 
is a transition in I(Q P ), and z" = Now, 

p( z) = A • (x + a • y) + A 0 = p(x) + a ■ (A • y) 

It is easy to see that for sufficiently large a we get p( z) < 0, since A • y < 0, 
which contradicts that p is BMS—QLRF(p). 

Case 2: Suppose (I25dl) is not satisfied, for some y" £ Tj. That is, A - (y — y') < 0. 
Choose x" £ Xi and define z" as above. Now, 

p( z) - P(z') = A ■ ((x + a ■ y) - (x' + a • y')) = p(x) - p(x') + a ■ (A • (y - y')) 

It is easy to see that for sufficiently large integer a we get p( z) — p{ z') < 0, since 
A • (y — y') < 0, which contradicts that p is BMS—QLRF(p). This concludes the 
proof. □ 

Lemma 10. If there no BMS—QLRF(p) for ,I(Qe), then there are 

finite sets X = X\ U • • • U Xu and Y = Yj U • • • U Y#, fulfilling the conditions of 
Definition [7J 

Proof. For 1 < i < let Qn = convhiill{X,;} + cone{T,} be the generator 
representation of the integer hull of Qi, and define X = Xi U ■ • ■ U I< and 
Y = Yi U • • • U Yj. We claim that (X,Y), fulfill the conditions of Definition [Tj 
Assume the contrary, i.e., (125al) - (125cl) has a solution (Ao,A) £ Q” +1 , we show 
that p(x) = A • x + Ao is a BMS—QLRF(p), contradicting the assumption that 
no BMS—QLRF(p) exists. 

Pick a point x" £ I(Qi), and let X. t = {x'/,..., x^} and Yi = {y",..., y"}. 
Note that x" = YllLi a i ' l ■ y” for some rationals ai,bj > 0, where 

Xo=i a i ~ 1- We show that p correctly ranks x", i.e., fulfills the corresponding 
conditions of BMS-QLRF depending on if x" comes from I{Q P ) or from I{Qf) 
with i p: 

— If x" £ I(Q P ), then each x" £ X, satisfies (125al25bl) and each y'f £ Tj satisfies 
(125dl25e[) . then, it is easy to check that this necessarily imply p(x) > 0 and 
p(x) - p(x') > 1. 

— If x" ^ Q PI , then each x " £ Xi satisfies (125cl) and each y" £ Tj satisfies 
(125cl) . it is easy to check that this necessarily imply p(x) — p(x') > 0. 

This concludes the proof. □ 
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Lemma 11. If there is a finite witness for the nonexistence of BMS—QLRF(p) 
for /(Qi),..., I{Qe), then there is one whose bit-size is polynomial in the bit-size 

of Qi, ■ ■ ■ ,Q(- 

Proof. By Lemma [lUJ we conclude that if there is a witness then there is one, 
X = Xi U • • • U X( and Y = Y± U • • • U Y(, such that Xi and Y come from the 
generator representation of Qij. 

Recall that (I25al) - (l25cl) has no solution for the points of X and Y. A corollary 
of Farkas’ Lemma [25j p. 94] states that if a finite set of inequalities over Q d , for 
some d > 0, has no solution, there is a subset of at most d + 1 inequalities that 
has no solution. Since the set of inequalities (125al) - f25cl) is over Q" +1 , there is a 
subset of at most n + 2 inequalities that has no solution. 

These inequalities correspond to n + 2 points out of the sets Xj. Yi. Let Xi 
(respectively Y) be the set of points that come from Xi (respectively Yi). Since 
(l25a.D - (l25cD has no solution for these sets, at least one of the points must come 
from a set X p (otherwise 0 is a solution). But n + 1 other points might come 
from sets Y- Since a witness must satisfy Y 0 =>• Xi 0 and X p ^ 0, we 
may have to add n + 1 points to form a valid witness, for a total of 2 n + 3. The 
bit-size of this witness is polynomial in the input bit-size, because each point 
comes from the generator representation of some Qn, and it is known that it is 
possible to choose a generator representation in which each vertex has a bit-size 
that is polynomial in the bit-size of Qi (see 0 Th. 2.7 and Th. 2.8]). □ 

Checking that a given X = Xi U-"Ul{ and Y = Y\ U ■ ■ ■ U Ye is a witness 
as in Definition [I] can be done in polynomial time as follows: First we verify that 
each x" G Xi is in /(Q,;), which can be done by verifying A;x" < cand that 
each y" G Y) is in KJZq^, which can be done by verifying A,y < 0. This is done 
in polynomial time. Note that according to Lemma [9] it is not necessary to check 
that Xi and Y come from a particular generator representation. Then we check 
that (125al) - (l25cl) has no solution, which can be done in polynomial time since it 
is an LP problem over Q n+1 . 

Corollary 2. There is a polynomially checkable witness for the nonexistence of 
a BMS-QLRF for I(Qi),..., I(Q t ). 

Proof. The witness consists of i witnesses, {X 1 , Y 1 ),..., (X e , Y 1 ), each as in 
Definition[l]for some 1 < p < I. Thus, the i- th one witnesses against the existence 
of BMS—QLRF(i). Thus all together witness against the existence of BMS- 
QLRF. Its size is clearly polynomial in the the input-bit size, and it can be 
checked in polynomial time by checking each (X~ l ,Y l ) as described before. □ 

Theorem 5. BMS— LexLinRF(Z) G coNP for MLC loops. 

Proof. Straightforward, given Proposition |T] and Corollary [5] □ 
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B Complexity of the bounded-dimension decision 
problem for ADFG-LLRF and BG-LLRF 


We assume a given MLC loop Qi,. ■ ■ ,Qk where each Q t is given as a set of 
linear constraints over 2 n variables (n variables and n primed variables). The 
different bounded-dimension decision problems are denoted, naturally, by BG- 
LexLinRF(cZ, Q), BG-LexLinRF(cI,Z), ADFG-LexLinRF(cZ, Q), and ADFG- 
LEXLiNRF(d, Z). In this appendix we assume familiarity with sections 2.1 and 
5 of 0. 

Theorem 6. BG-LEXLiNRF(d, Q) and ADFG-LexLinRF(cI, Q) are in P. 

Proof. We solve the problem by synthesizing an optimal-dimension BG-LLRF or 
ADFG-LLRF, which in both cases is PTIME. Then, we simply answer positively 
if and only if we found a tuple of dimension at most d. □ 

Next we move to BG-LexLinRF(cI,Z) and ADFG-LexLinRF(cI, Z), and 
show that both are coNP-complete. In both cases coNP-hardness is straightfor¬ 
ward, since for d = 1 it becomes the problem of deciding if there is an LRF, 
and the argument can easily be extended to larger d. The rest of this section is 
dedicated to the inclusion in coNP. 

Theorem 7. BG-LEXLiNRF(d, Z) and ADFG-LEXLiNRF(d, Z) are in coNP. 

We prove for BG-LexLinRF(cI, Z), and then comment on how the proof can be 
adapted to ADFG-LExLiNRF(d, Z) as well. 

The main step of the proof is to describe the form of a witness against the 
existence of a d-conrponent BG-LLRF. The technical details of the proofs can be 
worked out exactly as in the corresponding proofs in Appendix Oof this article, 
or in [3] Sec. 5.2]. Thus, we only sketch them here. 

Lemma 12. Let 


T d C T d -1 C-CTiC J(Qi) U • • • U J(Qfc), 


such that (z) there is no LRF for T d ; and (if) for each t = 1,..., d — 1, ev¬ 
ery quasi- LRF for Te does not decrease on any of the transitions T( + 1 . Then 
I(Qi),..., I(Qk) has no BG-LLRF of dimension (at most) d. Conversely, if 
there is no BG-LLRF of dimension at most d, there is a chain of sets as above. 

Proof. (=>■) Suppose in contradiction that t = (pi,..., p d ) is a BG-LLRF (note 
that we can always pad the tuple to dimension d if it is of a smaller dimension). 
Then p± is a quasi-LRF for Ti, and so by 0) does not decrease on T^. Hence 
(p 2 , ■ ■ ■ ,p d ) is a BG-LLRF for T?. Proceedings in this way we deduce that p d 
must be an LRF for T d , contradicting (0. 

(<t=) Suppose that there is no BG-LLRF of dimension at most d. Following 
the BG-LLRF (synthesis) algorithm ]3] Alg. 1, p.30], we see that one of the 
following must happen: (1) within d recursive calls, the algorithm fails to find 
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a non-trivial quasi-LRF, or (2) arf+l recursive call is reached. We construct 
sets Tj,... ,T d that satisfy (liliil) as follows: Let (Vji ,..., Vjk), for 1 < j < d, be 
the parameters received by the BG-LLRF algorithm in j-th invocation (if the 
algorithm stops at iteration s < d, we assume Vji = V s i for any s < j < d); and 
define Tj = u£_ 1 I{Vji) 1 for 1 < j < d. □ 

In what follows, given sets of integer points X' C X and Y' C Y, we let 
r(X, y, X’, Y') be the conjunction of the following inequalities: 


A-x Ao A 0 

for all x" G X 

(26a) 

A-y > 0 

for all y" G Y 

(26b) 

A • (x — x') >0 

for all x" G X 

(26c) 

O 

Al 

1 

for all y" G Y 

(26d) 

^ • ( x - x ') + 
x"£X' ; 

^ • (y - y') > 1 

v"eY' 

(26e) 

Intuitively, (X, Y) and ( X' , Y') will be generators of sets of integer points T'CT 
such that the solutions of r(X,Y,X',Y') are the quasi-LRFs of T that also 
decrease on some points of T'. For sets of integer points X and Y we let T(X, Y) 
be the conjunction of the following inequalities: 

A-x -(- Ao A 0 

for all x" G X 

(27a) 

A-y > 0 

for all y" G Y 

(27b) 

A • (x — x') > 1 

for all x" G X 

(27c) 

o 

Al 

1 

for all y" G Y 

(27d) 


Intuitively, (X, Y) will generate a set of integer points T, and the solutions of 
&(X, Y) are all LRFs of T. 

Definition 5. Given (X \, Fj),..., (Xd, Yd), where Xj = Xji U • • ■ U Xjk and 
Yj = Yji U • • • U Yjk, such that 

(a) X di C X (d _ 1}i C • • • C X u C I(Q t ); 

( b ) Y di c y (d _ 1}i c • • ■ c Yu c nn Qi ); 

(c) Yji ^ 0 =» Xji ^ 0. 

We say that {X\, Yj ),..., (X d , Y d ) form a witness against the existence of a BG- 
LLRF of dimension at most d for I(Qi),... ,I{Qk) if it satisfies the following 
requirements: 

( d ) &(X d ,Y d ) has no solution; and 

(e) r(Xi, Yj, Yi + i), for any 1 < i < d — 1 , has no solution. 

Each (Xj,Yj) corresponds to a set of integer points Tj such that Tj + 1 C Tj. 
In addition, condition |d]) guarantees that T d has no LRF, and condition (jej) 
guarantees that there is no quasi-LRF for Tj that is decreasing for some points 
ofT j+1 . 
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Lemma 13. Let (X\, Y\ {Xj, Yd) be as in Definition [3 Then there are 
Td C • • • CTi C I(Qi) U • • • U I{Qk) satisfying the requirements of LemmaU. M 

Proof. We construct sets of transitions Td C Td- 1 C • • • C T) C /(Qi) U • • • U 
I(Qk) that satisfy the requirements of Lemma [1^1 We construct Tj from (Xj,Yj) 
as follows: 


Tj = {x" + ay” | x" G X jU y" G Y ji: integer a > 0 } . 

Note that for x" G Xj, and y" G K,-,;. the point x" -f- ay", for any integer a > 0, 
is a transition in I(Qi), thus Tj C /(Qi) U • • • U I(Qk)- We claim that these sets 
satisfy the requirements of Lemma 1121 the proof can be worked out similarly 
to [5J Lemma 5.18]). □ 

The last result states that our witnesses are sound—they really imply that 
there is no BG-LLRF of the desired dimension. Next we should also prove that 
when there is no such BG-LLRF, witness sets as above exist, and their size can 
be polynomially bounded. 

Lemma 14. Suppose that I{Q \),... ,I(Qk) has no BG-LLRF of dimension at 
most d. Then there are (Xi,Y\),... ,{Xd,Yd) of bit-size polynomially bounded 
by the bit-size of the input transition polyhedra (as constraints), fulfilling the 
conditions of Definition [3 

Proof. Consider again the BG-LLRF algorithm [3, Alg. l,p.30], if the integer 
loop /(Qi),..., I(Qk) has no BG-LLRF of dimension at most d, one of the 
following happens: (1) within d recursive calls, the algorithm fails to find a non¬ 
trivial quasi-LRF, or (2) a d + 1 recursive call is reached. Let (Vji, ■ ■ ■ ,Vjk), 
for 1 < j < d, be the parameters received by the BG-LLRFs algorithm in j-th 
recursive call (if the algorithm stops at iteration s < d, we let Vji = V S i for any 
s < j < d). Define Tj = U^ =1 I(Vji), for all 1 < j < d. Then, clearly T\,..., Td 
are sets of transitions that satisfy the requirements of Lemma [HI We construct 
a witness that corresponds to these sets as follows: First note that each Vji is 
integral, and has a corresponding generator representation 

Vji = convhull{A'j.j} + cone{lji} . 

where Xji and Yji are finite sets of integer points. Then, we define each compo¬ 
nent (Xj, Yj) of the witness as Xj = Xji U ... U Xjk and Yj = Yji U ... U Yjk- 

This witness satisfies condition of Definition [5] because we may assume 
that none of the transition polyhedra is a cone (otherwise the loop clearly does 
not terminate), and thus X,j ^ 0. To show that it satisfies conditions (tafbl) as 
well, we rely on the following fact [25] p.107]: if a polyhedron V = convhullj X} + 
cone{y} is a face of a polyhedron V' = convhullj A"} + cone{W}, then X C X' 
and Y C Y'. Now a property of the BG-LLRF algorithm [3] Lemma 5.8] is that 
V(j+i)i is a f ace °f T’ji, and thus A(j +1 p C Xji and YJy+ip C Yji, so the witness 
satisfies conditions (tafbl) . Showing that conditions (IcHct) hold can be worked out 
as in [3] Lemma 5.19]. Finally, We can reduce the witness above to polynomial 
bit-size, using the same arguments as [3] Lemma 5.22]. □ 
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Checking a witness can be done in polynomial time as follows: First we verify 
that each x" £ Xji is in I(Qi ), which can be done by verifying Ax" < c*; and 
that each y" £ Y-p is in I (7 ZqI), which can be done by verifying Ay" < 0. This is 
done in polynomial time. Checking that <P(X A Yd) and _T(A, Yi, Xi + i, Y)_|_i) have 
no solution can be done in polynomial time since it is an LP problem over the 
rationals. This concludes the proof of Theorem^ and thus BG-LexLinRF(c?, Z) 
is coNP-complete. 

B.l The case of ADFG-LLRFs 

Next we explain how to adapt the above proof to ADFG-LLRFs. The same 
approach works for adapting the coNP-completeness proof of [3] for the existence 
of BG-LLRFs to the case of ADFG-LLRFs. 

The important difference between the quasi-LRFs used in ADFG-LLRF from 
those of BG-LLRFs is that they the must be non-negative over all I( Qi ),...,/( Qk) 
This means that when checking that a witness has no solution (signifying that 
there is no LRF, or no quasi-LRF with a certain non-triviality restriction) we 
should take this additional restriction into account. This can be done by ex¬ 
tending the witness with an extra component X' = X[ U • • • U X' k and Y’ = 
Yj U • • • U Yj., such that ( i) X[ C I(Qj) and finite; (ii) Yj C /(AlqJ and finite; 
and (Hi) Yj ' / 0 =>■ X' / 0. In addition, we add the the following in inequalities 
requirements from a witness 


A-x + Ao > 0 for all x" £ X' 

A-y > 0 for all y" £ Y'. 


(28a) 

(28b) 


C Approximation of Minimum Dimension 

Since finding out whether a BMS-LLRF of dimension d exists is NP-hard and 
-hard, for rational and integer loops, respectively, a natural question to ask 
is if we can approximate the minimum dimension in polynomial time. 

Rational loops. It is know that it is impossible to approximate, in polynomial 
time, the chromatic number of r-uniform hypergraphs on n vertices within a 
factor n 1_e , for any e > 0, unless NP C ZPP [18]. Given our reduction, we con¬ 
clude that it is impossible to approximate the minimal dimension of BMS-LLRFs 
within a factor k 1 ~ e , for any e > 0, unless NP C ZPP (recall that n vertices 
generate k paths in our reduction). Similarly, we cannot do such approximation 
within a factor smaller than |, unless P = NP, because we can then decide if a 
3-uniform hypergraph has 2-coloring, which is an NP-complete BIT . 

Integer loops. A polynomial algorithm, even given access to an NP oracle (a SAT 
solver) for free, cannot approximate the minimum dimension d of BMS-LLRFs 
within a factor smaller than |, unless Ejj = Ajj. This is because if such an 
algorithm exists, then for the loop T, a result of 2 will mean that (*) is true, 
and any other result (necessarily 3 or 4, since it has to be under | • 3) will mean 
that it is false. Thus a A^-hard problem is solved in A^ complexity. 
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